modify session data?

[Shilo]

Just out of curiosity...

 

... Is it possible for people to modify thier session data. for example:

 

If there session user_level was = 0. is it possible for them to modify it to be user_level = 1? or would they have to access the server files to do it.

 

Basically what im asking is: When a session is registered. is any form of the session stored on the clients computer like a cookie is? or am I pretty safe registering user_level =0 or =1 and having like

 

<?php
if ($_SESSION['user_level'] = 0){
echo 'user links';
}
if ($_SESSION['user_level'] = 1){
echo 'admin links';
}
?>

[ratcateme]

a cookie is stored on their PC that contains a session id then that session id is used to get the values for $_SESSION from a file on the server

 

Scott.

[Shilo]

okay. that cleared it up for me. Thank you